CVE-2026-98175: smb: client: cancel reconnect work in clean_demultiplex_info()
In the Linux kernel, the following vulnerability has been resolved:
smb: client: cancel reconnect work in cleandemultiplexinfo()
cleandemultiplexinfo() cancels server->echo delayed work but not server->reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work is still queued:
cifsdemultiplexthread() cifsreadvfromsocket() cifsreconnect() cifsreconnect() cifsqueueserverreconn() moddelayedwork(cifsiodwq, &server->reconnect, 0) cleandemultiplexinfo() canceldelayedworksync(&server->echo) // echo canceled // reconnect NOT canceled kfreesensitive(server) // server freed
...later, on cifsiodwq:
smb2reconnectserver() server->srvcount // UAF read of freed server
Fix this by canceling server->reconnect delayed work in cleandemultiplexinfo() before the server is freed, the same way cifsputtcpsession() already does.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In clean_demultiplex_info(), cancel the server->reconnect delayed work before the server is freed, using cancel_delayed_work_sync(&server->reconnect), to prevent queued reconnect work from accessing freed server memory.